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How to deal with confidential health care )iedbemation has: ‘been on 
the public agenda in Ontario for over a decade: Medicalinf orma- 
tion is probably the most sensitive type of personal information that 
is compiled on a routine basis in our society. With the diverse and 
sophisticated systems of health care delivery available today, a host 
of different entities collect, store and disseminate medical informa- 
tion. These include: hospitals, clinics, nursing homes, doctors in 
private practice, various government institutions such as the Min- 
istry of Health, Health Units and the Workers’ Compensation 
Board, pharmacies, various school systems, not to mention private 
firms. 


In surveying this vast field of health care institutions and other 
entities that collect or make use of such information, it becomes 
evident that broad legislation controlling the collection, retention, 
use, disclosure and security of medical information — wherever it 
may reside — is not only essential, but long overdue. While we are 
very pleased that the Minister of Health introduced Bill 24, placing 
controls on the new health number, we anxiously await further 
developments in this area with regard to the broader confidentiality 
legislation noted above, which is expected in draft form some time 
this year. 


Since one of the mandates of the Office of the Information and 
Privacy Commissioner is to comment on the privacy protection 
implications of proposed legislation and government programs, I 
was pleased to participate in a workshop held by the National Task 
Force on Health Information in Ottawa. Established in 1990, the 
Task Force assists the National Health Information Council in 
developing a long term plan for the evolution of a national system 
for health information. The impact of privacy and confidentiality 
concerns on the use of health information for research and statisti- 
cal purposes were discussed. The use of technologies such as 
electronic data linkage or computer matching of different databases 
of medical and other information, was explored at length. 


Computer matching, which involves the electronic data linkage of 
separate databases to identify similarities or differences in the 
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Access 


Fundamental to the mandate of the Office of the Information and 
Privacy Commissioner (IPC) is the resolution of disputes between 
requesters and institutions regarding the right of access to records 
in the custody or under the control of these institutions. 


When a request for access to general records or personal informa- 
tion has been denied, the requester has a right under the Act to 
appeal the institution’s decision to the IPC. When an appeal is 
received, the Appeals Department first tries to mediate a settlement 
between the parties. If mediation is not possible, the appeal pro- 
ceeds to an inquiry where all parties are given an opportunity to 
make submissions to the Commissioner or Assistant Commissioner 
before an order is issued. 


The IPC is currently examining the format in which orders are 
prepared to ensure they meet the needs of all parties involved in the 
appeal process. The goal of the review is to develop one or more 
order formats that: 


* are understandable and easily readable; 

* accurately and adequately reflect the decision-maker’s 
view of the application of the Acts to the facts of the ap- 
peal; 

- uphold the parties’ rights to administrative fairness by ad- 
equately responding to the issues and representations; and 

« develop the interpretation of the Acts. 


In keeping with this goal, a number of institutions and appellants 
were contacted and asked for feedback regarding previous orders 
issued by the IPC. As recipients of our orders, their suggestions for 
improvement will be an important factor in determining the form 
that orders take in the future. 


The timeliness of the order review is especially appropriate consid- 
ering that the Municipal Freedom of Information and Protection of 
Privacy Act came into effect on January 1, 1991. As of February 28, 
1991, 53 municipal appeal files have been opened. This figure 
represents 38% of all appeal files opened to that point in 1991. 
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Privacy (cont’d) 


information, has clear privacy implications. As computer matching can, among other 
things, detect persons or organizations that may be intentionally defrauding the 
government, it is used extensively to identify those suspected of abusing the system. 
While computer matching may appear on the surface to be logical and defensible, it 
is imperative that procedural safeguards be put into place prior to approval and 
implementation. The central issue in this debate is whether there are adequate 
safeguards associated with the technology to prevent violations of personal privacy. 


To properly examine computer matching within the Ontario government, our office 
recommended to the Standing Committee of the Legislative Assembly that a Task 
Force be created to examine this issue and its associated privacy concerns. In our brief 
to the Committee in its three-year review of the provincial Freedom of Information 
and Protection of Privacy Act, 1987, we suggested that such a task force recommend 
an appropriate mechanism to control and monitor computer matching within the 
Ontario government. 


Ann Cavoukian, Ph.D. 


Access (cont’d) 


Over the past three years, the proportion of pro- 
vincial appeals resolved by order has fallen 
steadily, from 40 per cent in 1988 to 32 per cent 
in 1989 to only 16 per cent in 1990. As institu- 
tions become more knowledgable about the Act, 
requests are responded to in accordance with the 
presumption that the record should be released, 
unless an exemption applies. Of those decisions 
that are appealed, many are settled on the basis 
of an explanation of the Act to either or both 
parties, and a realization from one or the other 
that either the record should be released or an 
exemption properly applies. It is hoped that this 
trend will be repeated under the municipal Act, 
as experience with that Act increases. 


Tom Wright 


FOIP TRACKING SYSTEM 


UPDATE 


As mentioned in the Winter 1991 IPC Newsletter, the FOIP 
Tracking System was delivered to some 400 municipal and 
provincial institutions last December. These institutions received 
a free copy of the Tracking System software, installation instruc- 
tions and user’s manual. The purpose of the FOIP Tracking 
System is to allow Co-ordinators to monitor requests and produce 
summary reports from a database of requested information. 


The FOIP Tracking System HOTLINE -— (416) 326-1989 — has 
been busy, so it is evident a number of people have been using 
the system. Some of the more common problems include: 


1. Anumber of people have been copying the software onto their 
computers rather than following the installation procedure. 
The installation procedure asks some questions about the 
computer being used and the institution. The answers are used 
to set-up the system properly. Just copying the software 
results in an incomplete system. 


2. Some system users have found the information they have 
recorded for their first few requests appears “strange”. The 


solution is to go to the UTILITIES area of the system and 
perform a REINDEX. In fact, reindexing seems to cure most 
problems and is often a good thing to try when a problem is 
first discovered. 


3. First-time system users are sometimes baffled by the Login 
screen, particularly if no user-ID’s have been created. The 
user-ID field can be skipped by hitting ENTER or RETURN, 
depending on your keyboard. Then use the Systems Admin- 
istrator password created during installation. 


4. Due toa system problem the Lister Report cannot be used at 
present. This is being corrected in Version 2 of the software, 
and is expected to be functional in the near future. 


All inquiries should be directed to the HOTLINE. If calling about 
a problem, please be sure to complete the problem checklist 
described on page US9 of the User’s Manual. This step will cut 
down on the number and length of the phone calls needed to solve 
the problem. 


On the occasion of the three-year review of the provincial Freedom 
of Information And Protection of Privacy Act, 1987, the Office of 
the Information and Privacy Commissioner (IPC), presented a brief 
to the Standing Committee on the Legislative Assembly. This 
included a document entitled “Suggested Changes to the Freedom 
of Information and Protection of Privacy Act, 1987” which de- 
scribes the proposals from the office of the IPC. 

The report sets out three types of changes to the Act. The first 
are “technical changes”, which are prompted largely as a result of 
faulty legislative drafting, and do not affect substantive rights. The 
second type of suggested changes have been classified as “clarifi- 
cation changes” and could affect substantive rights. They are 
considered necessary in order to make the Act work more effec- 
tively. The third part of the report details “policy changes” which 
affect substantive rights and may result in changes in the way 
decisions are made. Several “policy change” suggestions that touch 
on the substantive provisions of the Act are highlighted as follows. 

Subsection 52(6) of the Act gives the head of an institution 
the authority to require the Commissioner to inspect a record at the 
ministry or agency. It is the practice in the vast majority of appeals 
for the institution to forward a copy of the record to the IPC offices. 
However it is possible, given the Act’s present wording, that a head 
could require the Commissioner and IPC staff to view all records 
relating to every appeal at the institution’s premises. This is both 
impractical and clearly not the intent of the legislation. Therefore, 
the IPC has suggested that this section be amended to restrict 
on-site examination of records to exceptional circumstances where 
it would not be practical to reproduce the record by reason of its 
length or nature. 

The Act provides that where an institution does not respond 
to a request for access within the 30-day time period, the head is 
deemed to have refused access. However, if the deemed refusal is 
appealed, no penalty is available for failure to adhere to the 
statutory time limits, and therefore, the institution has little incen- 
tive to comply. To address this deficiency, the IPC suggests that a 
subsection be added to the Act which allows the Commissioner, in 
a deemed refusal situation, to require the head to waive fees which 
would otherwise be recoverable. 

The Act, in setting out the various privacy protection provis- 
ions, is largely silent regarding an institution’s obligation to ensure 
the security of personal information. Since institutions must con- 
sider security-related matters in order to fully comply with the 
privacy provisions of the Act, the IPC feels this obligation should 
be explicitly acknowledged and addressed in the legislature. 

There are anumber of other privacy-related issues that require 
attention. The IPC has included a suggested change that would 
require all correspondence to the IPC from minors and those in 
correctional institutions or psychiatric facilities be kept confiden- 
tial. The need for confidentiality is vital, and will ensure that these 
people are more fully able to exercise their rights under the Act. 

Another significant issue considers the use of mailing lists. 
Lists of individual’s names and addresses are compiled almost 
routinely by organizations for a variety of purposes, but principally 
for commercial gain. While Part III of the Act recognizes and 
protects personal privacy by restricting the use and disclosure of 
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information, the protection may not extend far enough to include 
mailing lists. The IPC suggests that a sub-clause be added to the 
Act which would include mailing lists to the category of informa- 
tion that, when released, is presumed to constitute unjustified 
invasion of personal privacy. 

The last issue to be highlighted concerns the extension of the 
powers of the Commissioner. It is recognized by the IPC that any 
extension of formal powers must be carefully considered by the 
Standing Committee on the Legislative Committee. 

The IPC recommends that the Commissioner be authorized 
to extend the period for filing an appeal beyond the 30-day time 
limit, in special circumstances. As long as the exercise of discretion 
is restricted to exceptional cases, the underlying principles of the 
Act are better served by expressly authorizing the Commissioner 
to extend the time period; concerns about equity and justice should 
prevail over strict adherence to time limits. 

The IPC also suggests that consideration be given to the 
following two related amendments. First, the Act, while stating that 
the Commissioner can make an order disposing of an appeal, it does 
not explicitly provide that an action or decision of the Commis- 
sioner is final and conclusive. It is clear from a review of the 
debates when the Act was originally passed, that the legislature 
intended to establish the Commissioner as the ultimate decision- 
maker for appeals. The IPC proposes that an express provision to 
this effect, commonly referred to as a “privative clause”, be in- 
cluded in the legislation. 

Second, the IPC recommends that the Commissioner be given 
express authority to reconsider a decision or revoke an order, in 
exceptional circumstances. This would provide the necessary flex- 
ibility to correct the outcome of an appeal where an error has been 
made, and would eliminate the need for judicial review proceed- 
ings. 

These two suggested amendments are consistent with provis- 
ions found in the enabling legislation for tribunals performing 
comparable functions to that of the Commissioner. The IPC also 
recommends that the Act give the Commissioner explicit authority 
to investigate and review activities of institutions that may be in 
breach of the privacy principles of the Act. The Act imposes a duty 
on the Commissioner to perform certain functions, which im- 
plicitly requires the authority to investigate complaints and review 
information management practices of institutions. The proposed 
amendments codify this authority, following precedents found in 
other jurisdictions which have similar privacy protection legisla- 
tion, thereby eliminating any need for the IPC to rely on the good 
will of institutions when undertaking investigations and reviews. 

In conclusion, it is proposed that the Commissioner’s order- 
making powers be extended in the area of privacy protection. At 
present, these powers are restricted to ordering an institution to 
cease a personal information collection practice, or to destroy 
collections of personal information. The IPC believes this authority 
is not sufficient to adequately ensure the proper management of 
personal information, and that the Commissioner should also be 
given authority to order an institution to cease a use, disclosure or 
retention practice that contravenes the Act. 


Freedom of Information 
and Privacy Survey — Summary 


The Standing Committee on the Legislative Assembly, as part of 
its three-year review of the Freedom of Information and Protection 
of Privacy Act, 1987, as amended, initiated a survey to examine the 
functions of the Freedom of Information and Privacy (FOIP) 
offices and Co-ordinators. The office of the Information and Pri- 
vacy Commissioner/Ontario administered the survey on behalf of 
the Committee. Specifically, the Committee wanted to know how 
well the Act had been implemented. Some 129 institutions were 
surveyed. The results of that survey are summarized below. It 
should be indicated that this summary is based on a broad interpre- 
tation of the results obtained from the survey. The document 
entitled Freedom of Information and Privacy Survey of Ontario 
Government Institutions provides a more detailed analysis. 


Survey findings show that institutions, on the whole, have sought 
to implement the Act reasonably effectively. Of the institutions 
surveyed, most have FOIP Co-ordinators in place, most provide 
reading rooms or library facilities for the public, and at least the 
minimum materials, such as the Directory of Records, to assist the 
public with requests. In addition, most institutions have the means 
to respond to French language requests in that language. Some 
institutions still need to develop their own internal procedural 
guidelines for applying the provisions of the Act to their particular 
circumstances. 


With regard to the Co-ordinators, the evidence is less uniform. 
Survey findings indicate that: 


generally, there is an adequate level of staffing to deal 
with requests. 

Co-ordinators are not highly placed within the decision- 
making processes and structures of the institutions, and 
on the whole, are fixed at the mid to lower end of the 
management scale. 

most Co-ordinators are principally focused on the pro- 
cessing of requests and dealing with appeals and less 
with other aspects of their roles and duties, particularly in 
the area of privacy protection. 


Finally, in assessing the overall implications of the survey results, 
access measures seem to have been effectively implemented while 
privacy concerns have received less attention to date. The immedi- 
ate need to respond to access requests necessitated the concentra- 
tion of FOIP efforts on this aspect of implementation. Limited time 
and resources may have contributed to the lack of progress in 
privacy issues and procedures. This area of concern, therefore, 
should represent the next major area for development. 


For Your Interest 


The following is a list of those who gave presentations or submis- 
sions (other than IPC), before the Standing Committee on the 
Legislative Assembly during its open sessions as of February 28. 


¢ Management Board of Cabinet, Freedom of Information 
and Privacy Branch 
¢ Ken Rubin, Ottawa Researcher 
¢ Ontario Highway Transport Board 
¢ Environmental Assessment Board 
¢ Parents Empowering Parents 
* Mohawk College 
« David Flaherty, Professor, University of Western Ontario 
* Sault Ste. Marie Police Service 
¢ Metropolitan Toronto Police Force 
¢ Ministry of the Solicitor General 
¢ Ontario Provincial Police 
¢ Joint Submission from: 
- Workers’ Compensation Appeals Tribunal 
- Pay Equity Hearings Tribunal 
- Ontario Labour Relations Board 
- Ontario Public Service Labour Relations Tribunal 
- Grievance Settlement Board 
¢ Ontario Genealogical Society 
Canadian Manufacturers’ Association 
Radio and Television News Directors Association 
Canadian Broadcasting Corporation 
Professors Christopher Armstrong & Susan Houston, York 
University 
¢ Professor Donald C. Rowat, Carleton University 
¢ Ontario Board of Examiners in Psychology 
¢ Canadian Daily Newspaper Publishers Association 


All inquiries should be directed to: 

Mr. Douglas Arnott 

Clerk of the Standing Committee on the Legislative Assembly 
Room 1521,Whitney Block,Queen’s Park 

Toronto, Ontario M7A 1A2 

(416) 325-3506 
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